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FOREWORD 


This  Final  Technical  Report  was  prepared  entirely  by  Information  Technology  and  Applications 
Corporation  (IT AC)  for  the  Information  Technology  Division  of  Sterling  Software,  in  response  to 
Contract  F30602-94-D-0007,  Task  0011. 


1.0 


INTRODUCTION 


The  purpose  of  this  final  technical  report  is  to  summarize  the  activities  of  the 
SATCOM/C2  effort  under  Task  Order  Agreement  number  F30602-94-D-0007.  There 
were  two  separate  tasks  under  this  contract.  Task  one  was  called  the  SATCOM  task 
and  task  two  was  for  the  C2/Protect  task.  The  period  of  performance  for  this  effort  was 
from  24  August  1995  to  30  September  1996. 

The  fundamental  purpose  of  the  AFSPC  SATCOM  task  was  to  improve  upon  the 
Satellite  Planning  Tool  (SPT)  software  program,  previously  developed  by  ITAC  for  the 
Air  Force  Satellite  Communications  Group  AFSPACECOM/SCZ.  Improvements 
consisted  of  software  anomaly  fixes  for  a  set  of  observed  errors  in  the  SPT  2.0  baseline 
and  various  enhancements  requested  by  the  AFSPACECOM/SCZ  customer.  The 
software  was  modified  in  two  phases  during  the  course  of  the  contract:  Build  One  and 
Build  Two. 

The  basic  purpose  of  the  C2  Protect  task  was  to  provide  USSPACECOM  and  AFSPC 
support  for  the  tailoring  and  manipulation  of  the  automated  risk  management  software, 
RISKWATCH,  to  the  specific  needs  of  the  commands  overall  and  each  major  staff 
section  within  them.  Assessment  results  were  compiled,  briefed  to  the  senior 
leadership,  and  utilized  to  (1)  tailor  the  risk  management  software:  (2)  produce  C2 
Protect  survey  disks  for  mass  distribution:  (3)  assemble  the  results  of  the  C2  Protect 
automated  surveys;  (4)  compare  the  survey  results  and  assessment  team  reports  to 
existing  regulations,  procedures,  and  policies:  (5)  assess  risk;  (6)  develop  cost- 
effective  countermeasures  to  mitigate  risk;  (7)  prepare  and  deliver  risk  mitigation 
decision  brief  to  senior  leadership;  (8)  effect  risk  mitigating  countermeasures. 

This  report  was  been  prepared  by  Mr.  Vince  Castello.  Any  questions  concerning  this 
report  shall  be  directed  to  Mr.  Castello  at  703-391-8822. 

2.0  SUMMARY  OF  TASK  EFFORTS 

2.1  TASK  ONE  -  SPT  3.0  ENHANCEMENTS 

As  mentioned  above,  the  SPT  3.0  upgrade  was  developed  in  two  builds  based  upon 
the  Statement  of  Work  and  Attachment  1,  AFSPC  Tech  note,  in  the  subcontract.  Build 
One  was  completed  and  installed  on  the  AFSPC/SCZ  computers  on  18  January  1996, 
with  the  Build  One  User  Manual  following  on  26  January.  Build  One  contained  all  of 
the  agreed  upon  changes  for  this  build  with  the  exception  of  the  deletion  of  the  full  map 
display  for  the  Mercator  projection  and  the  inclusion  of  a  few  Build  Two  requirements. 
Government  testing  of  Build  One  resulted  in  a  nominal  number  of  Software  Test  Action 
Reports  (STARS)  as  reflected  in  the  Technical  Report  dated  9  April  1996.  Build  Two 
was  initially  completed  and  shipped  to  AFSPC/SCZ  on  11  April  1996  along  with  the 
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draft  final  SPT  3.0  User’s  Manual.  The  bulk  of  the  STARS  received  for  Build  Two  were 
not  received  until  late  July  and  early  August.  A  total  of  51  STARS  were  received  for 
Build  Two,  with  the  majority  of  them  related  to  the  user  interface,  addressing 
consistency  and  user  preferences.  Most  of  these  were  resolved  by  telephone  with  Mr. 
Mike  Bordick  from  SCZ.  The  remainder  of  the  anomalies  were  corrected  and  a  final 
version  of  SPT  3.0  was  shipped  on  20  August  1996,  along  with  the  final  User’s  Manual. 
Only  one  known  problem  was  unresolved  by  the  time  funds  were  exhausted,  which  was 
concerned  with  the  footprint  overlay.  For  some  large  footprints,  typically  over  a  quarter 
of  a  hemisphere  in  size,  the  footprint  is  incorrectly  drawn  or  filled  on  a  Polar  map.  This 
problem  was  deeply  rooted  in  the  overlay  code  of  SPT  2.0  and  could  not  be  resolved 
with  available  remaining  contract  funds.  This  issue  was  communicated  to  the  SCZ 

contact. 

2.2  TASK  TWO  -  C2/PROTECT  SUPPORT 

There  were  seven  tasks  which  comprised  the  C2/Protect  effort  for  USSPACECOM  and 
AFSPACECOM.  The  tasks  included  analysis  of  the  state  of  operations  security  and 
information  warfare  vulnerability  for  above  organizations,  analysis  in  support  of  a  formal 
risk  analysis,  implementation  of  a  Riskwatch  analysis,  C2Protect  exercise  and  training 
support,  C2/Protect  education  and  training  support  and  development  of  departmental 
policies!  regulations  and  guidelines.  A  summary  of  accomplishments  follows: 

•  A  master  schedule  was  developed  for  the  project  and  submitted  in  September  1995. 

•  OPSEC/IW  briefings  were  developed  and  given  at  START  SMART  and  SAMBOC 
courses.  The  briefings  were  consistently  rated  extremely  high.  Other  briefings 
were  developed  and  presented  to  senior  officers  from  SOMSPACEAF, 
COMNAVSPACE,  Joint  Staff  J38  and  SMSC/CV. 

•  OPSEC/IW-Protect  was  integrated  into  numerous  exercise  scenarios. 

•  Critical  Information  Lists  (CILs)  were  developed  for  members  of  the  commands. 

•  Web  Information  warfare  home  pages  were  developed  for  the  21st  Net  Defensive 
and  USSPACECOM. 

•  Numerous  COMSEC  monitoring  and  Red  Team  efforts  were  scheduled  and 
coordinated. 

•  Anti-terrorism  assessments  were  conducted  for  AFSPC. 

•  OPSEC  training  was  integrated  into  the  JMETL  process. 

•  Extensive  policy  reviews  and  interaction  on  policy  issues  with  other  CINCs, 
Components  and  national  agencies  were  performed. 

•  Various  documents  were  reviewed  and  commented  on,  including  the  ARSPACE  C2 

Protect  Manual. 

•  Various  aspects  of  risk  analysis  utilizing  the  Riskwatch  analysis  tool  were  performed 
for  CMOC,  Cheyenne  Mountain  and  AFSPC/DOX.  This  effort  was  plagued  with 
numerous  problems  as  discussed  below  in  Section  3.0. 
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•  Coordinated,  hosted  and  participated  in  an  OPSEC  Day  for  USSPACECOM  in 
August. 

The  above  efforts  culminated  in  the  receipt  by  USSPACECOM  of  the  National 
Organizational  OPSEC  Award  in  June,  1996. 

3.0  LESSON  LEARNED 

The  choice  of  the  Riskwatch  software  for  risk  evaluation  turned  out  to  be  a  poor  one, 
for  two  basic  reasons.  The  first  reason  was  maturity  of  the  software.  There  were 
several  problems  that  occurred  over  time  with  operation  of  the  software.  Although  the 
company  was  very  supportive  to  resolve  problems,  problems  continued  to  surface.  The 
transition  from  a  DOS  to  a  Windows  version  just  compounded  the  issue.  The  first 
release  of  the  Riskwatch  software  was  more  of  a  beta  version  than  a  final  version.  The 
other  reason  was  that  the  underlying  risk  analysis  model  that  Riskwatch  was  based 
upon  was  an  evaluation  of  risk  based  upon  potential  financial  considerations  of  both 
the  value  of  what  would  be  lost  as  well  as  the  cost  to  replace  the  loss  or  compromise  of 
those  assets.  The  problem  here  was  that  the  organizations  which  we  were  trying  to  use 
Riskwatch  to  evaluate  did  not  typically  ‘value’  their  data  and  information  that  they 
protect.  Without  a  dollar  value  to  assess  risk  with  Riskwatch  did  not  have  great  utility. 
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MISSION 

OF 

ROME  LABORATORY 


Mission.  The  mission  of  Rome  Laboratory  is  to  advance  the  science  and 
technologies  of  command,  control,  communications  and  intelligence  and  to 
transition  them  into  systems  to  meet  customer  needs.  To  achieve  this, 
Rome  Lab: 


a.  Conducts  vigorous  research,  development  and  test  programs  in  all 
applicable  technologies; 

b.  Transitions  technology  to  current  and  future  systems  to  improve 
operational  capability,  readiness,  and  supportability; 

c.  Provides  a  full  range  of  technical  support  to  Air  Force  Material 
Command  product  centers  and  other  Air  Force  organizations; 

d.  Promotes  transfer  of  technology  to  the  private  sector; 

e.  Maintains  leading  edge  technological  expertise  in  the  areas  of 
surveillance,  communications,  command  and  control,  intelligence, 
reliability  science,  electro-magnetic  technology,  photonics,  signal 
processing,  and  computational  science. 

The  thrust  areas  of  technical  competence  include:  Surveillance, 
Communications,  Command  and  Control,  Intelligence,  Signal  Processing, 
Computer  Science  and  Technology,  Electromagnetic  Technology, 
Photonics  and  Reliability  Sciences. 


